Isolate npm .tgz in packages/ subfolder so ESRP skips 1ES SBOM _manifest (#1193)

The ESRP release job kept failing at "submitting request to Release
Gateway" with "The first argument must be of type string... Received
undefined". Root cause: 1ES injects an SBOM _manifest/ folder at the
root of every published pipeline artifact, so ESRP's folderlocation
contained the .tgz plus 10 non-.tgz _manifest files. With
contenttype=npm ESRP tries to derive name@version from every file in
the folder; the _manifest files yield undefined and crash the gateway
request build.

Fix: the build stages the tarball into an npm-packages/packages/
subfolder (the SBOM _manifest/ stays a sibling at the artifact root),
and the release points ESRP folderlocation at
$(Pipeline.Workspace)/npm-packages/packages so it only ever sees .tgz.

Co-authored-by: Tarun Ramsinghani <tarunramsinghani@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: adeae005-934b-42dd-ae33-4ea3e7992002

Author: tarunramsinghani

.azure-pipelines/azure-pipelines-build.yml

@@ -119,20 +119,30 @@ extends:
                 workingDirectory: node
 
               # Produce the .tgz that ESRP will publish. ESRP does not pack; we
-              # stage the tarball into $(Build.ArtifactStagingDirectory)/npm-packages
-              # and publish it as the 'npm-packages' artifact (see outputs above).
+              # stage the tarball into a `packages/` SUBFOLDER of the artifact
+              # ($(Build.ArtifactStagingDirectory)/npm-packages/packages) and
+              # publish the parent as the 'npm-packages' artifact (see outputs).
+              #
+              # WHY THE SUBFOLDER: 1ES injects an SBOM `_manifest/` folder at the
+              # ROOT of every published pipeline artifact. If the .tgz sat at the
+              # artifact root next to `_manifest/`, the release pipeline's ESRP
+              # `folderlocation` would enumerate those non-.tgz SBOM files and
+              # fail trying to derive npm name@version from them (ESRP crashes
+              # with "...Received undefined" while submitting the release request).
+              # Keeping the .tgz in `packages/` leaves `_manifest/` a sibling, so
+              # the release points ESRP at `.../npm-packages/packages` (only .tgz).
               - script: |
                   set -e
-                  mkdir -p "$(Build.ArtifactStagingDirectory)/npm-packages"
-                  npm pack --pack-destination "$(Build.ArtifactStagingDirectory)/npm-packages"
+                  mkdir -p "$(Build.ArtifactStagingDirectory)/npm-packages/packages"
+                  npm pack --pack-destination "$(Build.ArtifactStagingDirectory)/npm-packages/packages"
                   echo "Packed contents:"
-                  ls -l "$(Build.ArtifactStagingDirectory)/npm-packages"
+                  ls -l "$(Build.ArtifactStagingDirectory)/npm-packages/packages"
                 displayName: 'npm pack -> staging'
                 workingDirectory: node/_build
 
               # Fail the build if npm pack produced no package files.
               - script: |
-                  count=$(ls -1 "$(Build.ArtifactStagingDirectory)/npm-packages"/*.tgz 2>/dev/null | wc -l)
+                  count=$(ls -1 "$(Build.ArtifactStagingDirectory)/npm-packages/packages"/*.tgz 2>/dev/null | wc -l)
                   echo "Found $count .tgz file(s)."
                   if [ "$count" -eq 0 ]; then
                     echo "ERROR: npm pack produced no .tgz files; nothing to release."
@@ -146,7 +156,7 @@ extends:
               # tarball, fail here rather than shipping a polluted npm package.
               - script: |
                   set -e
-                  for tgz in "$(Build.ArtifactStagingDirectory)/npm-packages"/*.tgz; do
+                  for tgz in "$(Build.ArtifactStagingDirectory)/npm-packages/packages"/*.tgz; do
                     echo "Inspecting $tgz for stray _manifest/ entries..."
                     if tar -tzf "$tgz" | grep -E '(^|/)_manifest/' ; then
                       echo "ERROR: '$tgz' contains an SBOM/_manifest folder; refusing to publish it inside the npm package."

.azure-pipelines/azure-pipelines-release.yml

@@ -108,7 +108,10 @@ extends:
               inputs:
                 # Download the .tgz produced by the 'build' pipeline resource.
                 # This is a declarative 1ES input (the template performs the
-                # download), so the job body stays a single ESRP task.
+                # download), so the job body stays a single ESRP task. The
+                # artifact contains packages/<name>.tgz plus a 1ES-injected
+                # SBOM `_manifest/` folder at its root; ESRP is pointed at the
+                # `packages/` subfolder below so it only ever sees the .tgz.
                 - input: pipelineArtifact
                   pipeline: build
                   artifactName: npm-packages
@@ -121,6 +124,13 @@ extends:
               #   waitforreleasecompletion=true                 -> block until done
               # ESRP does NOT run npm pack; it distributes the .tgz downloaded
               # above. The dist-tag is inferred from publishConfig.tag (latest).
+              #
+              # folderlocation points at the `packages/` SUBFOLDER of the
+              # downloaded artifact -- NOT its root. The build stages the .tgz
+              # there so it is isolated from the 1ES-injected SBOM `_manifest/`
+              # folder (which lands at the artifact root). ESRP must see ONLY
+              # .tgz files here; any non-.tgz sibling makes it fail deriving npm
+              # name@version ("...Received undefined" at release-request submit).
               # NOTE: EsrpRelease@12 also accepts `productstate: <tag>` to pin the
               # npm dist-tag explicitly (e.g. 'latest' or 'beta'); we intentionally
               # omit it and let publishConfig.tag drive the tag per requirements.
@@ -135,7 +145,7 @@ extends:
                   intent: 'PackageDistribution'
                   contenttype: 'npm'
                   contentsource: 'Folder'
-                  folderlocation: '$(Pipeline.Workspace)/npm-packages'
+                  folderlocation: '$(Pipeline.Workspace)/npm-packages/packages'
                   waitforreleasecompletion: true
                   owners: '$(EsrpOwners)'
                   approvers: '$(EsrpApprovers)'